diff --git a/main.go b/main.go
index 6fb7ac4..bc5cade 100644
--- a/main.go
+++ b/main.go
@@ -105,6 +105,8 @@ func main() {
 	dockerTimeoutFlag := app.Flag("docker-timeout", "Timeout for docker")
 	dockerTimeout := dockerTimeoutFlag.Default("1m").Duration()
 	pewCommand := app.Command("pew", "Build, run and test module/exploit")
+	pewMax := pewCommand.Flag("max", "Test no more than X kernels").
+		PlaceHolder("X").Default(fmt.Sprint(KERNELS_ALL)).Int64()
 	pewKernelFlag := pewCommand.Flag("kernel", "Override kernel regex")
 	pewKernel := pewKernelFlag.String()
 
@@ -205,7 +207,8 @@ func main() {
 	switch kingpin.MustParse(app.Parse(os.Args[1:])) {
 	case pewCommand.FullCommand():
 		err = pewHandler(kcfg, *path, *pewKernel, *pewBinary,
-			*pewTest, *pewGuess, *qemuTimeout, *dockerTimeout)
+			*pewTest, *pewGuess, *qemuTimeout, *dockerTimeout,
+			*pewMax)
 	case kernelListCommand.FullCommand():
 		err = kernelListHandler(kcfg)
 	case kernelAutogenCommand.FullCommand():
diff --git a/pew.go b/pew.go
index c2affe9..ce74164 100644
--- a/pew.go
+++ b/pew.go
@@ -285,13 +285,27 @@ func whatever(swg *sizedwaitgroup.SizedWaitGroup, ka config.Artifact,
 	}
 }
 
+func shuffleKernels(a []config.KernelInfo) []config.KernelInfo {
+	// Fisher–Yates shuffle
+	for i := len(a) - 1; i > 0; i-- {
+		j := rand.Intn(i + 1)
+		a[i], a[j] = a[j], a[i]
+	}
+	return a
+}
+
 func performCI(ka config.Artifact, kcfg config.KernelConfig, binaryPath,
-	testPath string, qemuTimeout, dockerTimeout time.Duration) (err error) {
+	testPath string, qemuTimeout, dockerTimeout time.Duration,
+	max int64) (err error) {
 
 	found := false
 
 	swg := sizedwaitgroup.New(runtime.NumCPU())
-	for _, kernel := range kcfg.Kernels {
+	for _, kernel := range shuffleKernels(kcfg.Kernels) {
+		if max <= 0 {
+			break
+		}
+
 		var supported bool
 		supported, err = ka.Supported(kernel)
 		if err != nil {
@@ -300,6 +314,7 @@ func performCI(ka config.Artifact, kcfg config.KernelConfig, binaryPath,
 
 		if supported {
 			found = true
+			max -= 1
 			swg.Add()
 			go whatever(&swg, ka, kernel, binaryPath, testPath,
 				qemuTimeout, dockerTimeout)
@@ -355,7 +370,8 @@ func genAllKernels() (sk []config.KernelMask, err error) {
 
 func pewHandler(kcfg config.KernelConfig,
 	workPath, ovrrdKrnl, binary, test string, guess bool,
-	qemuTimeout, dockerTimeout time.Duration) (err error) {
+	qemuTimeout, dockerTimeout time.Duration,
+	max int64) (err error) {
 
 	ka, err := config.ReadArtifactConfig(workPath + "/.out-of-tree.toml")
 	if err != nil {
@@ -383,7 +399,7 @@ func pewHandler(kcfg config.KernelConfig,
 		}
 	}
 
-	err = performCI(ka, kcfg, binary, test, qemuTimeout, dockerTimeout)
+	err = performCI(ka, kcfg, binary, test, qemuTimeout, dockerTimeout, max)
 	if err != nil {
 		return
 	}